Do not use list in access-control header