patch: apply HTTP header "modifications" to RESPONSE, rather than REQUEST