Ah ok, so the point is to protect the backend then? But by inspecting the headers are you still not hitting the backend? I guess that winds up putting way less load on the backend?