http headers on heroku
heroku http headers
xss & regex