Add X-Download-Options and X-Permitted-Cross-Domain-Policies

Two small security hardenings for our IE users and those with Adobe products. Aligns it more with https://github.com/twitter/secureheaders#secureheaders---