cleanup + access control headers + query a poach