BZ-1155269, BZ-1155270: additional support for security headers