added middleware to set default security headers