Add XCTO and XXSSP security headers.

An explanation of these headers can be found at:
https://www.owasp.org/index.php/List_of_useful_HTTP_headers

The new stooge web service from Mozilla's security team checks for
the presence of these headers.