added security.allow_x_headers to control usage of HTTP_X headers in Input