Add Cookie ID to request headers
Track security events
Only try to send X-headers when present