add Target-Endpoint to allowed headers