diff --git a/external_auth/oidc-httpd-configs/application.conf b/external_auth/oidc-httpd-configs/application.conf
index 60f71e7..546b85f 100644
--- a/external_auth/oidc-httpd-configs/application.conf
+++ b/external_auth/oidc-httpd-configs/application.conf
@@ -13,8 +13,16 @@ Options SymLinksIfOwnerMatch
   ProxyPreserveHost on
   RequestHeader set Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
   RequestHeader set X-Forwarded-Host ${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
+  Header always unset Strict-Transport-Security
   Header always set Strict-Transport-Security "max-age=631138519"
+  Header always unset X-Content-Type-Options
   Header always set X-Content-Type-Options "nosniff"
+  Header always unset Referrer-Policy
+  Header always set Referrer-Policy "no-referrer-when-downgrade"
+  Header always unset X-Frame-Options
+  Header always set X-Frame-Options "SAMEORIGIN"
+  Header always unset Reporting-Endpoints
+  Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""
 
   RewriteCond %{REQUEST_URI}     ^/ws/notifications [NC]
   RewriteCond %{HTTP:UPGRADE}    ^websocket$ [NC]
diff --git a/external_auth/oidc-httpd-configs/authentication.conf b/external_auth/oidc-httpd-configs/authentication.conf
index 291db12..08d0057 100644
--- a/external_auth/oidc-httpd-configs/authentication.conf
+++ b/external_auth/oidc-httpd-configs/authentication.conf
@@ -2,38 +2,47 @@ LoadModule auth_openidc_module modules/mod_auth_openidc.so
 ServerName http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}
 LogLevel   debug
 
-OIDCProviderMetadataURL            https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration
 OIDCClientID                       ${HTTPD_AUTH_OIDC_CLIENT_ID}
 OIDCClientSecret                   ${HTTPD_AUTH_OIDC_CLIENT_SECRET}
-OIDCRedirectURI                    http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri
-OIDCCryptoPassphrase               sp-secret
-OIDCOAuthRemoteUserClaim           username
-OIDCCacheShmEntrySizeMax           65536
-
 OIDCOAuthClientID                  ${HTTPD_AUTH_OIDC_CLIENT_ID}
 OIDCOAuthClientSecret              ${HTTPD_AUTH_OIDC_CLIENT_SECRET}
+
+OIDCProviderMetadataURL            https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/.well-known/openid-configuration
+
 OIDCOAuthIntrospectionEndpoint     https://${HTTPD_AUTH_HOST}:8443/realms/ManageIQ/protocol/openid-connect/token/introspect
 OIDCOAuthIntrospectionEndpointAuth client_secret_post
+
+OIDCRedirectURI                    http://${HTTPD_AUTH_HOST}:${HTTPD_AUTH_PORT}/oidc_login/redirect_uri
+
+OIDCOAuthRemoteUserClaim           username
+OIDCPassClaimsAs                   both none
+
+OIDCCacheShmEntrySizeMax           65536
+OIDCCacheShmMax                    500
+
 OIDCCookieSameSite                 On
+OIDCCryptoPassphrase               sp-secret
 
 # different from production (hacks for self signed keys ssl)
 OIDCSSLValidateServer              Off
 OIDCOAuthSSLValidateServer         Off
 # /different
 
-OIDCPassClaimsAs both none
-
 # Set HSTS globally
+Header always unset Strict-Transport-Security
 Header always set Strict-Transport-Security "max-age=631138519"
+Header always unset X-Content-Type-Options
 Header always set X-Content-Type-Options "nosniff"
+Header always unset Referrer-Policy
+Header always set Referrer-Policy "no-referrer-when-downgrade"
+Header always unset Reporting-Endpoints
+Header always set Reporting-Endpoints "csp-endpoint=\"https://%{HTTP_HOST}i/dashboard/csp_report\""
 
 # CSP for OIDC authentication redirects - allows inline styles/scripts needed by auth flow
 <Location /oidc_login>
   AuthType                   openid-connect
   Require                    valid-user
   FileETag                   None
-  # Explicit HSTS for redundancy
-  Header always set Strict-Transport-Security "max-age=631138519"
   Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"
@@ -45,8 +54,6 @@ Header always set X-Content-Type-Options "nosniff"
   AuthType                   openid-connect
   Require                    valid-user
   FileETag                   None
-  # Explicit HSTS for redundancy
-  Header always set Strict-Transport-Security "max-age=631138519"
   Header always setifempty Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; report-uri /dashboard/csp_report; report-to csp-endpoint"
   Header set Report-To       "{\"group\":\"csp-endpoint\",\"max_age\":10886400,\"endpoints\":[{\"url\":\"/dashboard/csp_report\"}]}"
   Header Set Cache-Control   "max-age=0, no-store, no-cache, must-revalidate"