Test that setRequestHeader() cannot be used to alter security-sensitive headers. This test PASSED if you see console warnings.