Returned Location Header in Security API gives different results.