updated comments on several functions in hopes that it is clear to the security reviewers that we are constructing HTTP Link headers, not HTML tags