SEC-2348: Security HTTP Response Headers enabled by default w/ XML