X_CTO code in secureheaders