handle headers in a more appropriate place; add some validation