Header forgery now happens once