HTTP Security

https://medium.freecodecamp.org/web-security-an-introduction-to-http-5fa07140f9b3
https://www.troyhunt.com/i-wanna-go-fast-https-massive-speed-advantage/
http://qnimate.com/what-is-multiplexing-in-http2/

https://medium.freecodecamp.org/secure-your-web-application-with-these-http-headers-fd66e0367628

Response headers:

Strict-Transport-Security: max-age=3600
Expect-CT: max-age=3600, enforce, report-uri="https://ct.example.com/report"
X-Frame-Options: DENY
X-XSS-Protection: 1; report=http://xssviolations.example.com/collector
Content-Security-Policy: default-src 'self'; report-uri http://cspviolations.example.com/collector
Feature-Policy: vibrate 'self'; push *; camera 'none'
Access-Control-Allow-Origin: https://example.com.