Don't allow through any client headers besides rollntime and midstate