twitter/secureheaders — pull request #123 by stve (2014-11-18 18:28:21+00:00)
Title: X-Permitted-Cross-Domain-Policies support

This PR implements the `X-Permitted-Cross-Domain-Policies` header with the default value of `none`. I reviewed the discussion in #88 while working through this. Given the discussion around versioning, it seemed like `none` was an ok default given the impending major version bump.

In the process of working through this, I found that `X-Download-Options` wasn't documented in the README, the 2nd commit addresses that.