The moral here is to use X- headers for evil, because people will quickly notice when you start injecting random stuff into URLs you don't manage. Actually, cu

The moral here is to use X- headers for evil, because people will quickly notice when you start injecting random stuff into URLs you don't manage. Actually, current or planned location of the client is a sensible thing to provide in some standardized header, though of course not without informed consent.