Use X-VSF instead of X-SEC to match the rest of the VCL

The log statements refer to X-SEC headers, while the rest of the code uses X-VSF.