web: set security headers also for non HTTPS

Fixes: #493

web/rootfs/defaults/meet.conf

@@ -11,6 +11,10 @@ ssi_types application/x-javascript application/javascript;
 index index.html index.htm;
 error_page 404 /static/404.html;
 
+# Security headers
+add_header X-Content-Type-Options nosniff;
+add_header X-XSS-Protection "1; mode=block";
+
 location = /config.js {
     alias /config/config.js;
 }