Function _lock_session_key

Scripts/ButSystem.py:1762–1763

(owner: str, scope: str, target)

    try:
        _ensure_device_fp_cookie(resp)
    except Exception:
        pass
    resp.headers.setdefault("X-Frame-Options", "DENY")
    resp.headers.setdefault("X-Content-Type-Options", "nosniff")
    resp.headers.setdefault("Referrer-Policy", "same-origin")