Attribute not in HTTP header

[Rod Widdowson]

Some questions

1) What is the webserver?  From the URL I'd guess IIS but that needs to be stated.
2) What version of the SP?  You are using the legacy namespace which might argue 2.  If it's two nobody is going to be able to help you much till you update.
3) If SP3 are you using the ISAPI or the IIS7 plugin?  If the former, why?

Finally, why are you even looking at the HTTP headers?  They are not required and there are a great number of very good reasons to not use them.

Rod

Oh yes, one more thing: Your headers don't have the anti=spoofing values in them either so you have a fundamental setup/configuration issue.