proper secure header check