Extra security headers without a home