Security Headers on the App

The app now sends standard security headers, so no other website can load it inside a frame. Published accessibility statements are the one exception, so the embed code you place on your own site keeps working.