Post-processing of the response (after routing).

        We attempt to follow many of the 'hardening reponse headers'
        best practices. These include things like:

            HPKP: HTTP Public Key Pinning
            HSTS: HTTP Srict Transport Security
            X-Content-Type-Options:
                prevents mime-sniffing so user generated content
                isn't auto determined as something it shouldn't be.
            XSS Protection: built in reflective XSS protection

def process_response(self, req, resp, resource):
        """ Post-processing of the response (after routing).

        We attempt to follow many of the 'hardening reponse headers'
        best practices. These include things like:

            HPKP: HTTP Public Key Pinning
            HSTS: HTTP Srict Transport Security
            X-Content-Type-Options:
                prevents mime-sniffing so user generated content
                isn't auto determined as something it shouldn't be.
            XSS Protection: built in reflective XSS protection
        """

        hpkp = goldman.config.HPKP

        if hpkp:
            resp.set_header(
                'Public-Key-Pins',
                '{}; includeSubdomains; max-age=31536000'.format(hpkp),
            )

        resp.set_header(
            'Strict-Transport-Security',
            'max-age=31536000; includeSubDomains',
        )

        resp.set_header(
            'X-Content-Type-Options',
            'nosniff',
        )

        resp.set_header(
            'X-Xss-Protection',
            '1; mode=block',
        )