make excluded_headers a configurable variables that defaults to ['HTTP_COOKIE']
mention config for excluded_headers