Add security headers

Since nginx is used, security headers can be added, e.g.
```         
add_header X-Content-Type-Options "nosniff" always;
add_header X-Frame-Options "DENY" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Referrer-Policy "no-referrer" always;
```
(just an example)

Add headers on demand (`Strict-Transport-Security`, `Content-Security-Policy`, etc.).