disable security headers as rupert instructed over the phone