The Conundrum of Declarative Security HTTP Response Headers: Lessons Learned