Are we sure we want to get rid of this? I know @diracdeltas raised some concerns, but I also think it might be useful as another layer of defense-in-depth. It is used by [major sites](https://www.owasp.org/index.php/List_of_useful_HTTP_headers#Real_life_examples).