vary CSP header for HTTP and HTTPS, and secure cookies

Jesse Norellrequested to merge
jnorell/ispconfig3:security_headers into stable-3.1

Slightly ugly on the CSP, but a "set" followed by an "edit" didn't work, it required a second "set" to override the first.

Edited by Jesse Norell

Merge request reports