add security headers to static site

[jessemtso]

[jhertz]

that'll be in here https://github.com/ripgarpr/garpr/blob/master/webapp/serve_webapp.tac

[jhertz]

also need content-type or at least content encoding headers