Preventing cache poisoning via HTTP X-headers