nginx add_header Appends. It Doesn't Override — And That Can Remove Protection.

TL;DR — I shipped a baseline of security headers into every generated nginx vhost, meaning it as a fallback for applications that send none of their own. Within the hour, production was answering with...