Allow all headers on root and subpolicies