3.13.2. esapi utilisation

<?xml version="1.0" encoding="UTF-8"?>
<policy>
      <settings>
              <mode>redirect</mode>
              <error-handling>
                      <default-redirect-page>/security/error.jsp</default-redirect-page>
                      <block-status>403</block-status>
              </error-handling>
      </settings>
      <outbound-rules>
              <add-header name="FOO" value="BAR" path="/.*">
                      <path-exception type="regex">/marketing/.*</path-exception>
              </add-header>
      </outbound-rules>
</policy>