next actor automatically removes security header