Add security related headers

[mdPlusPlus]

See https://securityheaders.com (currently C rating).

[mdPlusPlus]

As of 1b27769 we achieve an A+ rating from https://securityheaders.com.
Maybe there should be some further fine-tuning.

Details:

Header	Value
Content-Security-Policy	default-src 'https:'
Referrer-Policy	same-origin
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block
Strict-Transport-Security	max-age=63072000; includeSubdomains; preload

[mdPlusPlus]

Current rating A: