Reinforcing security headers