update security headers

nginx.conf

@@ -25,6 +25,8 @@ http {
 
     #gzip  on;
 
+    server_tokens off;
+
     server {
         listen       80;
         server_name  localhost;
@@ -36,6 +38,11 @@ http {
             root   /usr/share/nginx/html;
             index  index.html index.htm;
 
+            add_header Cache-Control "no-cache";
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com";
+            add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload";
+            add_header X-Content-Type-Options "nosniff";
+
             rewrite ^/admin(.*)(?<!\.html)$ /admin.html last;
             rewrite ^/workgroups(.*)(?<!\.html)$ /workgroup.html last;
             rewrite ^/summary(.*)(?<!\.html)$ /summary.html last;

vendor/css/neon.css

@@ -1,6 +1,6 @@
 /**** Isotope Filtering ****/
-@import url("http://fonts.googleapis.com/css?family=Noto+Sans:400,700,400italic");
-@import url("http://fonts.googleapis.com/css?family=Montserrat:400,700");
+@import url("https://fonts.googleapis.com/css?family=Noto+Sans:400,700,400italic");
+@import url("https://fonts.googleapis.com/css?family=Montserrat:400,700");
 .isotope-item {
   z-index: 2;
 }