SECURITY: RawAction: Vary on the usual headers