corrected header length when security is on