secure headers added to ui api