You can set HTTP header on an API route just by returning a Response object with the headers set within the second parameter. On a page route with a handler where you are already rendering server-side fetched data (with context.render), that context.render call actually returns a Response object. Instead of immediately returning the result, put it into a response variable. Now you can response.headers.set("Header-Name", "header value"') to set the header. Finally, return the modofied header. Of course this works for any HTTP and not just security headers.