set some security flags recommended by the Mozilla Observatory