Fix: enable secure header middleware by default

[tadhglewis]

Idk why we wouldn't have this?

As such, it's important that this middleware is only used under these circumstances:

1. The app's domain does not mix HTTP and HTTPS.

2. The response is an API response, i.e. it is not being directly rendered by the browser.

3. The responses have an accurate Content-Type header.

https://github.com/seek-oss/koala/tree/master/src/secureHeaders

[changeset-bot]

🦋 Changeset detected

Latest commit: caaece5

The changes in this PR will be included in the next version bump.

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[tadhglewis]

Related: #1602

[AaronMoat]

Hoping for other opinions, but I don't mind the change. I'd like your thoughts on whether adding some form of warning / documentation linking is suitable here?

[72636c]

@etaoins do you have any thoughts as Koala BDFL?

[etaoins]

I don't mind this either. This is the big one because it can break loading all HTTP resources hosted on the same domain:

The app's domain does not mix HTTP and HTTPS

However, that's become even less common in the 5 years since this documentation was written. The other caveats only have a local effect and would presumably be caught during testing.

[AaronMoat]

Can you add a patch changeset, please?