allow authorization header
drop powered-by header
its invalid, not random