This needs an "else: return" instead of falling through if the regex fails.  I'd also give the secret header a more cumbersome name so it doesn't conflict with anything else that may try to use a "Reason" header (maybe "X-HTTP-Reason"?)