Inject some security related HTTP headers by default.