code: def allow_headers(self, domain, headers, secure=True):
          
          if self.site_control == SITE_CONTROL_NONE:
              raise TypeError(
                  METAPOLICY_ERROR.format("allow headers from a domain")
              )
          self.header_domains[domain] = {'headers': headers,
                                         'secure': secure}
docs: Allows ``domain`` to push data via the HTTP headers named in
          ``headers``.
  
          As with ``allow_domain``, ``domain`` may be either a full
          domain name or a wildcard. Again, use of wildcards is
          discouraged for security reasons.
  
          The value for ``headers`` should be a list of header names.
  
          To disable Flash's requirement of security matching (e.g.,
          retrieving a policy via HTTPS will require that SWFs also be
          retrieved via HTTPS), pass ``secure=False``. Due to security
          concerns, it is strongly recommended that you not disable
          this.