HTTP header security concern

So, just to clarify, the concern is that the header you insert is a security risk? I'm not sure how this could be a problem and why he'd refer to headers coming in from the outside world. Regardless, perhaps you could add some code to delete other 'dodgy' headers and also delete any existing instance of the header you plan to insert, before you insert it, to prevent any spoofing by the client.