HTTP Headers not sent when user not logged in and in /tree?

Hi,
I am trying to set HTTP headers like `Content-Security-Policy, X-Content-Type-Options, Cache-Control ` by setting values in jupyter_notebook_config.py as
```
c.NotebookApp.tornado_settings = {
'headers': {
X-Content-Type-Options': 'nosniff'
}
}
```

However, when notebook is opened in Firefox or IE, it by default goes to /tree? (when user logged in) and /login (if user not logged in). In both of these cases headers are not present. Headers are present only when user is logged in and no /tree? etc path is appended in URL.

Start with jupyter_notebook_config.py and the tornado_settings headers configuration, then reproduce requests to /login and /tree in both authenticated and unauthenticated states. Compare their response headers with the direct notebook URL; done means the configured headers are present on all relevant responses.

Written by the indexing model from the issue text.