added a local-host authorizer, renamed mongoose header to not be confused with possible system headers. add document-root support