Security improvements

* Fixed setting of default HTTP response headers
* Added additional response headers based on OWASP ZAP recommendations
* Set force_ssl = true for production