Address Was scan vulnerability issues

## What is the problem?

Few items which can be improved are reported in the wav scan

Missing or Insecure "Object-Src" policy in "Content-Security-Policy” header
Missing or Insecure "Script-Src" policy in "Content-Security-Policy” header
Cookie with Insecure or Improper or Missing SameSite attribute
Unnecessary Http Response Headers found in the Application
Cacheable SSL Page Found

## What is the impact?

Improving this will help WAV scan results.

## Proposed solution

The issue lists WAV scan findings for Content-Security-Policy directives, cookie SameSite attributes, unnecessary response headers, and cacheable SSL pages, but names no files or tests. Start by identifying which application responses produce these findings, then rerun the WAV scan to verify that the reported items are resolved.

Written by the indexing model from the issue text.