change order to check headers, then query, then body