clarify that %{...}o uses *response* headers

cherry-picked from karenetheridge/topic/accesslog_handler_subs