controller can set status & headers of response