security and framework headers, using CF from 10.9.5 until 10.10 code is released