HtmlServlet sets some security-related headers as suggested by OWASP