defer looking up headers until the response callback is called (FBO things like sessionauthenticationpolicy which does its own header-setting when its remember/forget methods are called)
avoid a deprecation warning during test runs