BZ-1167986, BZ-1167987: remove restriction of some security header available only for https