use "curl -I" for header verification