Why some ajax calls not honoring server headers in response - dojo

Question

DISCLAIMER: perhaps wrong forum, might not be coding related…
If having a valuePicker on a Xpage like the following
<xe:djextListTextBox
id="djextListTextBox1"
value="#{requestScope.category}"
multipleTrim="true"
multipleSeparator=","
>
</xe:djextListTextBox>
<xe:valuePicker
id="valuePicker1"
for="djextListTextBox1"
dialogTitle="Category"
dojoType="extlib.dijit.PickerCheckbox"
>
<xe:this.dataProvider>
<xe:simpleValuePicker
valueList="red,green,blue"
valueListSeparator=","
>
</xe:simpleValuePicker>
</xe:this.dataProvider>
</xe:valuePicker>
The response header from the Ajax call is NOT honoring the http server headers set.
The reply:
HTTP/1.1 200 OK
Date: Wed, 14 Feb 2018 10:21:01 GMT
Content-Type: application/json;charset=utf-8
Expires: -1
Content-Encoding: gzip
Content-Length: 73
Strict-Transport-Security: max-age=604800; includeSubDomains
But another control on the same page using also an ajax call to the server honors the headers:
<xp:inputText
id="inputText1"
value="#{document1.subject}"
>
<xp:typeAhead
mode="full"
minChars="1"
valueList="alpha#beta#charlie#delta#echo#foxtrot"
valueListSeparator="#"
tokens=",/"
ignoreCase="true"
>
</xp:typeAhead>
</xp:inputText>
Response:
HTTP/1.1 200 OK
Date: Wed, 14 Feb 2018 10:34:36 GMT
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html;charset=UTF-8
Expires: -1
Content-Encoding: gzip
Content-Length: 48
Strict-Transport-Security: max-age=604800; includeSubDomains
Expires: Mon, 01 Jan 1990 23:59:59 GMT
Pragma: no-cache
Cache-Control: no-cache,no-store,private,must-revalidate
X-Frame-Options: DENY
The server has defined several HTTP headers that we need to be honored thru all the system but for this valuePicker the response excludes them.
Why is that and how can this be fixed?
Using Domino 9.0.1FP10 on a Win/64 server and headers are defined as Web Site Rule and in notes.ini:
Rule:
HTTP response codes: 200, 206, 404, 403, 401, 500
Always add header
Specify a date: Expires after 1900-01-01
Header 1: Pragma, no-cache, override=true
Header 2: Cache-Control, no-cache,no-store,private,must-revalidate, override=true
Header 3: X-Frame-Options, DENY, override=true
Notes.ini
HTTPAdditionalRespHeader=Content-Security-Policy: default-src 'self'; script-src 'self' https://*.fontawesome.com https://code.jquery.com 'unsafe-inline' 'unsafe-eval'; style-src 'self' https://*.fontawesome.com 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://*.fontawesome.com https://fonts.gstatic.com
Excluded the HTTPAdditionalRespHeader header from logs to make more readable…