Consider adding security headers to HTTP responses

[NullHypothesis]

E.g., default-src 'none'; frame-ancestors 'none'; base-uri 'none';