add CSP and X-Frame-Options header in default HTTP config