Config  with nonce header so redirects work