mitigate missing security headers