The REST framework should provide a mechanism for applying security headers to all responses.

To avoid piling onto the logic in the Handler base class, this could be implemented as a "middleware". This would require use to add support for such "middleware" to the REST framework.

For reference, see the security header filter implemented in RESTbase: https://phabricator.wikimedia.org/diffusion/GRES/browse/master/lib/security_response_header_filter.js