HTTP headers + security grade

Make a real GET request and inspect every response header — plus a quick security score.