Defer loading action_controller

Use the lazy-load hooks to include ::SecureHeaders. This will prevent action_controller/action_view from getting loaded unless it's required.