That's for sending headers to your web server or S3 though, not for sending headers to the user. There are a few extra headers you can send to the user, but not the security related ones.