Add more security-related response headers, and document them.