guard against req.headers being undefined