web/src/main/java/org/springframework/security/web/header/writers/HpkpHeaderWriter.java
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
		if (requestMatcher.matches(request)) {
			if (!pins.isEmpty()) {
				String headerName = reportOnly ? HPKP_RO_HEADER_NAME : HPKP_HEADER_NAME;
				if (!response.containsHeader(headerName)) {
					response.setHeader(headerName, hpkpHeaderValue);
				}
			} if (logger.isDebugEnabled()) {
				logger.debug("Not injecting HPKP header since there aren't any pins");
			}
		}
		else if (logger.isDebugEnabled()) {
			logger.debug("Not injecting HPKP header since it wasn't a secure connection");
		}
	}
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
		if (requestMatcher.matches(request)) {
			if (!pins.isEmpty()) {
				String headerName = reportOnly ? HPKP_RO_HEADER_NAME : HPKP_HEADER_NAME;
				if (!response.containsHeader(headerName)) {
					response.setHeader(headerName, hpkpHeaderValue);
				}
			} if (logger.isDebugEnabled()) {
				logger.debug("Not injecting HPKP header since there aren't any pins");
			}
		}
		else if (logger.isDebugEnabled()) {
			logger.debug("Not injecting HPKP header since it wasn't a secure connection");
		}
	}
/*
(non-Javadoc)

@see org.springframework.security.web.headers.HeaderWriter#writeHeaders(javax
.servlet.http.HttpServletRequest, javax.servlet.http.HttpServletResponse)