I wrote a flask extension that makes it a little easier to set these headers:

https://github.com/GoogleCloudPlatform/flask-talisman