X-* headers are not forwarded back to the browser. E.g.: X-Flash-Messages which is important for rails.

--- mod_security/nginx/modsecurity/ngx_http_modsecurity.c 2014-10-07 17:10:55.715371999 -0400
+++ mod_security/nginx/modsecurity/ngx_http_modsecurity.c 2014-10-07 17:17:57.207371999 -0400
@@ -212,6 +212,15 @@ static struct {
     {NULL,                ngx_null_string}
 };

+static char *x_special_headers[] = {
+  "x-frame-options",
+  "x-xss-protection",
+  "x-content-type-options",
+  "x-flash-messages",
+  "x-request-id",
+  "x-runtime"
+};
+
 static inline u_char *
 ngx_pstrdup0(ngx_pool_t *pool, ngx_str_t *src)
 {
@@ -826,6 +835,22 @@ ngx_http_modsecurity_save_headers_out_vi
     }

     ngx_strlow(h->lowcase_key, h->key.data, h->key.len);
+    h->lowcase_key[h->key.len] = '\0';
+
+    int i = 0;
+    int x_special_header_size = sizeof(x_special_headers) / sizeof(char *);
+    for(i; i < x_special_header_size; i++) {
+      if(!strcmp(h->lowcase_key, x_special_headers[i])) {
+
+        ngx_table_elt_t *tmp_header;
+        tmp_header = ngx_list_push(&r->headers_out.headers);
+        tmp_header->key = h->key;
+        tmp_header->value = h->value;
+
+        return 1;
+
+      }
+    }

     h->hash = ngx_hash_key(h->lowcase_key, h->key.len);