added specs and access-header
added spec for header's access control