def security_header_tween_factory(handler, registry):
    """Add security-related headers to every response."""
    def security_header_tween(request):
        resp = handler(request)
        # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy
        #
        # Browsers should respect the last value they recognise from this
        # list, thus browsers that don't support
        # strict-origin-when-cross-origin will fall back to
        # origin-when-cross-origin.
        resp.headers['Referrer-Policy'] = 'origin-when-cross-origin, strict-origin-when-cross-origin'
        # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
        resp.headers['X-XSS-Protection'] = '1; mode=block'
        return resp

    return security_header_tween