Add Secure HTTP headers

* X-Xss-Protection: 1; mode=block
* X-Content-Type-Options: nosniff
* X-Frame-Options: SAMEORIGIN
* Strict-Transport-Security: max-age=31536000