[schoen@eff.org: Threats to anonymity set at and above the application layer; HTTP headers]