Enforce HSTS and send the X-Frame-Options header on all resources