Updating conf to include secure cookies and XFO via CSP frame-ancestors

element/element.theschricks.com.conf

@@ -28,6 +28,10 @@ server {
 	add_header X-Frame-Options "SAMEORIGIN";
 	add_header Referrer-Policy "strict-origin";
 	add_header Permissions-Policy "geolocation=(),midi=(),sync-xhr=(),microphone=(),camera=(),magnetometer=(),gyroscope=(),fullscreen=(self),payment=()";
+	add_header Set-Cookie "Path=/; HttpOnly; Secure";
+
+	# CSP
+	add_header Content-Security-Policy "frame-ancestors 'self'";
 
     	# OCSP stapling
     	ssl_stapling on;