user, guest, and unsigned-in headers