Fix usage of the "enabled" attribute of the "header" extension point

The enabled attribute of the header extension point is never used: it should be possible to disable a header by using this attribute.

It is useful for example to disable the X-Frame-Options header which indicates whether or not a browser should be allowed to render a page in a frame.