restrict headers so we only use API headers