Perhaps I'm missing something.  I open a new composer window, select Insert -> Custom Header, and am presented with a small dialog that apparently lets me add a security header.  At least I think -- the UI shows no evidence that the header has actually been added.  Furthermore I see no way to add or delete custom headers, nor view which custom headers I've already added.

So... is this plugin unfinished or something?

I don't mean to be harsh, but the plugin is listed as "standard".  Clearly it belongs in "experimental" until it's... well, usable.