s3-waf: Also include source4/ when looking for headers