http: add random security headers