https://www.linuxsec.org/2017/02/hardening-http-security-headers.html