fixes #7985 - add support for ws:// in secure headers