removed header to prevent browser complaint about setting unsafe header