controller properly return Location header