moved allowed headers to config