moving header validation to a module so it can also be used in the application controller.  refs #8986