HTTP security headers

A client has brought up an issue that the application does not send standard security headers, most notably the content security policy and strict transport security headers. While these can be implemented manually it would be helpful to have these done as part of the installation.

No file or test is named. Start by tracing the installation path and the web application's HTTP response configuration, then check how security headers can be applied there. Done means installations send a content security policy and strict transport security header by default, with coverage for the resulting behavior.

Written by the indexing model from the issue text.