Allow request body and headers