Default security headers are a bit too strict

[g105b]

Makes it really difficult to include things like bootstrap

[g105b]

Take a look here:

WebEngine/src/Lifecycle.php

Lines 128 to 131 in f9c5d8e

	$response = $response->withHeader(
	"Content-type",
	$router->getContentType()
	);

This can be extracted into a separate function for setting the necessary response headers. The current Content-type header can be set as it is here, along with any headers defined within config.default.ini:

WebEngine/config.default.ini

Line 22 in 86ff1ea

default_headers="X-Content-Type-Options: nosniff; X-Frame-Options: deny; Content-Security-Policy: default-src 'none'"