announcement can be deleted by the person who posted it
put the header allow access control in config