audit proposal: http header best practices

https://www.youtube.com/watch?v=TNlcoYLIGFk

Some audits for HTTP responses I came up with after watching the above video:

#### `X-Frame-Options`

Suggest `Content-Security-Policy: frame-ancestors 'self'` instead. Offers more consistent behavior across browsers.

#### `Via`

Suggest removing or placing behind a X-Debug request header.

#### `Content-Security-Policy`

Suggest that it exist. Confirm it doesn't have unsafe-inline, unsafe-eval, or glob-starred CDNs/hosts (*.amazonaws.com).

#### `Referrer-Policy`

I suppose there's a valid use case for all values of this header. But what about ensuring that it exists (and suggest it be set to `origin-when-cross-origin`)?

#### `103 Early Hint`

If there are `Preload` headers, the server should also be sending `103` to make full use of preload.

#### `Feature-Policy`

Suggest that it exist. Link to cool resources about it.

#### `Strict-Transport-Security`

Suggest it exist.

#### `P3P`

Kill.

---------

see also https://www.fastly.com/blog/headers-we-want and https://www.fastly.com/blog/headers-we-dont-want