CloudFront can manage security headers for API responses, including STS, XSS and CSP.

We should configure these headers, via a response header policy, for every CloudFront distribution serving APIs.