XFO code in secureheaders