Called by:
Mobilizon.Web.Plugs.HTTPSecurityPlug.headers
(L44)