software/rapid-cdn: Switch to http-after-response

This is the only way to be assured that all expected headers are going to be
sent back to the client.

software/rapid-cdn/buildout.hash.cfg

@@ -38,7 +38,7 @@ md5sum = cba4d995962f7fbeae3f61c9372c4181
 
 [template-frontend-haproxy-configuration]
 _update_hash_filename_ = templates/frontend-haproxy.cfg.in
-md5sum = 84576e8b9923e3acfdd52d69e3bf807a
+md5sum = 00e5e02eb48363f962d4f8d9934e29c4
 
 [template-frontend-haproxy-crt-list]
 _update_hash_filename_ = templates/frontend-haproxy-crt-list.in

software/rapid-cdn/templates/frontend-haproxy.cfg.in

@@ -110,9 +110,9 @@ backend {{ slave_instance['slave_reference'] }}-{{ scheme }}
 {%-         else %}
   server {{ slave_instance['slave_reference'] }}-backend-{{ scheme }} {{ info_dict['hostname'] }}:{{ info_dict['port'] }}
 {%-           if slave_instance['disable-via-header'] %}
-  http-response del-header Via
+  http-after-response del-header Via
 {%-           else %}
-  http-response add-header Via "%HV rapid-cdn-frontend-{{ configuration['node-id'] }}-{{ configuration['version-hash'] }}"
+  http-after-response add-header Via "%HV rapid-cdn-frontend-{{ configuration['node-id'] }}-{{ configuration['version-hash'] }}"
 {%-           endif %}
 {%-           if scheme == 'https' %}
 {%-             if slave_instance['strict-transport-security'] > 0 %}
@@ -123,7 +123,7 @@ backend {{ slave_instance['slave_reference'] }}-{{ scheme }}
 {%-               if slave_instance['strict-transport-security-preload'] %}
 {%-                 do strict_transport_security.append('; preload') %}
 {%-               endif %}
-  http-response set-header Strict-Transport-Security "{{ ''.join(strict_transport_security) }}"
+  http-after-response set-header Strict-Transport-Security "{{ ''.join(strict_transport_security) }}"
 {%-             endif %}
 {%-           endif %}
 {%-           for disabled_cookie in slave_instance['disabled-cookie-list'] %}