Add some security headers, including CSP and HPKP

It would be nice to have some security headers: https://securityheaders.io/?q=https%3A%2F%2Fgethttpsforfree.com%2F

Especially a CSP could be very helpful here, as you can very strictly limit the JS use. However you may have to rewrite a few JS parts to be CPS-compatible (to not have to allow `insecure-eval`).
Also have a look at [report-uri](https://report-uri.io/) where you can collect CPS and HPKP violation reports.

As for HPKP [please be cautious with the LE client](https://community.letsencrypt.org/t/http-public-key-pinning-hpkp/2450). You might want to follow [this best practises](https://community.letsencrypt.org/t/hpkp-best-practices-if-you-choose-to-implement/4625).

Start with the securityheaders.io report linked in the issue, then review how this project serves its web responses and JavaScript. Define a CSP without insecure-eval where possible, assess the requested report-uri and HPKP settings against the linked guidance, and verify that the resulting headers and client behavior meet the security goals.

Written by the indexing model from the issue text.