fix missing Cert-Path on response headers