www/h2o*: set default http headers in samples, not add

This improves the default security posture of both h2o-flavoured ports.

Submitted by: Uwe Trenkner <uwe@trenknerconsulting.com>
Sponsored by: SkunkWerks, GmbH