move access control headers into app for proctor