added HTTP header X-Breach-Spoil to complicate BREACH attack