title: Can multiple Headers middlewares be combined?
body: <p>I have couple of services that require different <strong>Content-Security-Policy</strong> header. My initial attempt was to create a default middleware that will handle all common headers, and then I can create new middlewares with unique <code>contentSecurityPolicy</code> setting for each of the routers.</p>
  
  <p>I was surprised when it turned out that if you have multiple middlewares with headers, the last applied one overwrites the previous. This means I have to recreate all the headers in the middleware for each service. And if I make changes in the future, I would have to make sure this is reflected in all of them.</p>
  
  <p>As a workaround I tried to add <code>customResponseHeaders</code> with <strong>Content-Security-Policy</strong> header, but this did not overwrote the default header, even though it showed in the dashboard.</p>
  
  <p>Excerpt of my setup:</p>
  
  <pre><code>...
  [http.routers.service]
    rule = "Host(`example.com`)"
    entrypoints = ["https"]
    middlewares = ["default", "service"]
    service = "service"
  ...
  [http.middlewares.default.headers]
    accessControlAllowOrigin = "origin-list-or-null"
    stsSeconds = 315360000
    stsIncludeSubdomains = true
    stsPreload = true
    customFrameOptionsValue = "SAMEORIGIN"
    contentTypeNosniff = true
    browserXssFilter = true
    referrerPolicy = "strict-origin"
    contentSecurityPolicy = "default-src 'none';form-action 'none';frame-ancestors 'none';base-uri 'none'"
    featurePolicy = "notifications 'none'; camera 'none'"
  [http.middlewares.service.headers]
    contentSecurityPolicy = "default-src 'none';script-src 'self' 'unsafe-inline';style-src 'self';img-src 'self'"
  </code></pre>