code: func SetIndexHTMLHeaders(h http.Header) {
  	SetNoCacheHeaders(h)
  	SetSameOriginIFrame(h)
  	SetNoSniff(h)
  
  	// X-Frame-Options indicates that the page can only be displayed in iframe on the same origin as the page itself
  	h.Set("X-Frame-Options", "SAMEORIGIN")
  
  	// X-XSS-Protection is a feature of Internet Explorer, Chrome and Safari that stops pages
  	// from loading when they detect reflected cross-site scripting (XSS) attacks.
  	h.Set("X-XSS-Protection", "1; mode=block")
  
  	// Once a supported browser receives this header that browser will prevent any communications from
  	// being sent over HTTP to the specified domain and will instead send all communications over HTTPS.
  	// It also prevents HTTPS click through prompts on browsers
  	h.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
  
  	// Prevent web browsers from using content sniffing to discover a file’s MIME type
  	h.Set("X-Content-Type-Options", "nosniff")
  
  	// Set content policy flags
  	var cspValue = strings.Join([]string{
  		"script-src 'self'",
  		// 'unsafe-inline' needed for reactjs inline styles
  		"style-src 'self' 'unsafe-inline'",
  		"object-src 'none'",
  		"img-src 'self' data: blob:",
  	}, ";")
  
  	h.Set("Content-Security-Policy", cspValue)
  }
docs: // SetIndexHTMLHeaders sets security header flags for main index.html page