Headers defined in the `transform.response.headers configuration` are not properly translated and phishing domain is leaked.