There should be secure header tests that cover the off case, and the custom case