security: add option to configure tunnel header verification