holding off on the last issue until i confirm whether or not oreoshake can cover secure headers here