switched to req/res .header() interface to enforce better consistency