add SecurityHeadersFilter and fix deprecate play 2.3 warnings