extract security header
user security header