How to configure Glassfish 4 to include certain headers for a simple static website without writing java code? - http-headers

Question

I have a simple static website (a single index.html page and some css files) being served by a Glassfish 4 server. I am required to include the following headers:
- Cache-control: no-store
- Pragma: no-cache
- List item
- X-XSS-Protection
- content-security-policy
Googling only seems to provide answers which instruct me to open bla.java and extend catalina whatchamacallit response wrapper or creating a time-space continuum filter or cooking a pot of beans or other some-such. As I said above, I don't have a single java file in the entire website. Just plain old html and css.
Isn't there something I can add to the glassfish-web.xml to tell glassfish to include those headers?
As far as I can see, for other types of server it's just a simple matter of configuring the server:
IIS: add the headers and values from IIS panel
nginx: modify nginx.conf
Apache: modify httpd.conf
Do I really have to write java code to achieve this with glassfish?
This is what the directory tree of the entire project looks like:
├MyProject
├───pom.xml
├───src
│ └───main
│ ├───frontend
│ │ ├───index.html
│ │ ├───index.css
│ │ └───index.js
│ └───webapp
│ └───WEB-INF
│ ├───glassfish-web.xml
│ └───web.xml
└───target
├───MyProject.war
├───MyProject
│ ├───index.html
│ ├───index.css
│ └───index.js
└───maven-archiver
└───pom.properties
As one can see, no java file in sight. This question is therefore not a duplicate since the answers to similar questions is not aplicable to my question.
For completenes, here are the contents of the various XMLs:
pom.xml:
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.some.project</groupId>
<artifactId>com.some.project</artifactId>
<version>1.0.0</version>
<packaging>war</packaging>
<name>MyProject</name>
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.source>1.7</maven.compiler.source>
<maven.compiler.target>1.7</maven.compiler.target>
</properties>
<build>
<finalName>MyProject</finalName>
<plugins>
<plugin>
<groupId>com.github.eirslett</groupId>
<artifactId>frontend-maven-plugin</artifactId>
<version>1.6</version>
<configuration>
<workingDirectory>src/main/frontend</workingDirectory>
</configuration>
</plugin>
<plugin>
<artifactId>maven-war-plugin</artifactId>
<version>3.2.2</version>
<configuration>
<failOnMissingWebXml>false</failOnMissingWebXml>
<!-- Add frontend folder to war package -->
<webResources>
<resource>
<directory>src/main/frontend</directory>
</resource>
</webResources>
</configuration>
</plugin>
</plugins>
</build>
</project>
glassfish-web.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
<glassfish-web-app error-url="">
<context-root>/</context-root>
</glassfish-web-app>
web.xml:
<!-- <!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.4//EN" "http://java.sun.com/dtd/web-app_2_4.dtd"> -->
<web-app>
<display-name>MyProject</display-name>
</web-app>

Answer 1

Normally in big companies Glassfish is used together with Apache. So my idea would be to add the header information on the Apache side. But nonetheless found this page about Glassfish Server Tuning that might be useful.
Glassfish admin console
Tuning the GlassFish Server->File Cache Settings
You may find this information useful about Glassfish caching