add gzip, security headers