Merge pull request #2156 from overleaf/hb-secure-headers

Use helmet to set nosniff and sameorigin

GitOrigin-RevId: e5d684d772523ca740be75ebe9d248db74209f25

services/web/app/src/infrastructure/Server.js

@@ -204,9 +204,7 @@ webRouter.use(function(req, res, next) {
     dnsPrefetchControl: false,
     referrerPolicy: { policy: 'origin-when-cross-origin' },
     noCache: isLoggedIn || isProjectPage,
-    noSniff: false,
-    hsts: false,
-    frameguard: false
+    hsts: false
   })(req, res, next)
 })