Add security policy. Use hiccup to generated root HTML.