Fingerprinting based on HTTP response headers