rename whitelist

`ALLOWED_HEADERS`?