Anti-xss http headers

In HTTP they are some headers like:

```
X-Frame-Options:
Content-Security-Policy:
X-XSS-Protection:
```

They offer some cool features, for example telling the client not to execute external javascript files even if the website have them included (maybe by an xss).

The X-Frame-Options disables framing the website by an external website

The X-XSS-Protection is only used by Internet Explorer but it is worth to research about it.

https://developer.mozilla.org/en-US/docs/Web/Security/CSP/Introducing_Content_Security_Policy
https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options

Start by reading the linked MDN pages on Content-Security-Policy and X-Frame-Options, and research the role and support of X-XSS-Protection. The issue does not name files, tests, or an entry point; completion would require identifying the relevant HTTP response path and verifying that the requested security headers are emitted correctly.

Written by the indexing model from the issue text.