429 rate limit responses carry no security headers #1851

Observed while verifying docs for #1774 (PR #1849): the 429 from the proxy rate limiter has an empty body and none of the usual response headers (HSTS, X-Frame-Options, X-Content-Type-Options). Severity: low. Suggested: check whether the handler order puts the limiter before the headers handler and, if so, whether the headers should apply to its responses.