F: sanitized response headers (for HTML header injection attack)
A: redirect method