Security improvements

* Fixed setting of default HTTP response headers
* Added additional response headers based on OWASP ZAP recommendations
* ~~Set force_ssl = true for production~~ when turned on server currently redirects request in a way that will never complete