def _add_header_domains_xml(self, document):
        """
        Generates the XML elements for allowed header domains.

        """
        for domain, attrs in self.header_domains.items():
            header_element = document.createElement(
                'allow-http-request-headers-from'
            )
            header_element.setAttribute('domain', domain)
            header_element.setAttribute('headers', ','.join(attrs['headers']))
            if not attrs['secure']:
                header_element.setAttribute('secure', 'false')
            document.documentElement.appendChild(header_element)