moved security headers into the config module