HTTP header won't work, since the client must have sent the full request before the server can respond with a HTTP header, it is already too late to protect the

HTTP header won't work, since the client must have sent the full request before the server can respond with a HTTP header, it is already too late to protect the data inside the client's request. If anything it should perhaps be some kind of SSL handshake flag. Also, not a single site will actually set the flag that indicates their SSL implementation sucks.