How do you get a Hugo site to set better security headers? With netlify.toml!