[security] M-9: /headers endpoint info disclosure without auth

[jacobyoby]

Severity: Medium
File: users/views.py:1121

Problem

The /headers endpoint discloses request headers and server information without authentication.

Remediation

Add @login_required decorator or remove the endpoint in production.

Source

Finding from security audit (2026-08-31). See .github/SECURITY_AUDIT_TRIAGE.md.