have security filter return custom header indicating authentication status