exclude HTTP_COOKIE header from request.headers, since headers are already included in request.cookies.