    public function common_headers()
    {
        if (headers_sent()) {
            return;
        }

        // Unlock IE compatibility mode
        if ($this->browser->ie) {
            header('X-UA-Compatible: IE=edge');
        }

        // Request browser to disable DNS prefetching (CVE-2010-0464)
        header("X-DNS-Prefetch-Control: off");

        // send CSRF and clickjacking protection headers
        if ($xframe = $this->app->config->get('x_frame_options', 'sameorigin')) {
            header('X-Frame-Options: ' . $xframe);
        }
    }
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.