I see the idea, and this is interesting ...
however, nothing protects the user from modifying `header' even after the header is actually sent to client...

And one might think `header' contains the header sent to the client ...

I will try to think more on that, and for now invite other to comment.