update explanation of secure HTTP headers #134