When running a workspace in either FME Server or FME Cloud it would be a great secure feature if FME_SERVER_REQUEST_HEADERS contained the real request headers sent to the server from the client, not the localhost.
I hope they choose to include the fmetoken, since then it would make certain streaming services much safer.
