Wait, what am I missing here? - the source code is open, so we can see that this is going on - the url where the headers are downloaded from is open so we can

Wait, what am I missing here? - the source code is open, so we can see that this is going on - the url where the headers are downloaded from is open so we can see / monitor whatever headers get added I'm not a security expert, just a lowly developer, what sequence of events should I be concerned about?