Hm, ‘an and logic’ sounds a bit off, to me. Perhaps ‘The headers are only set if (1) the request is considered safe and (2) the request matches *all* criteria.