allow restricted headers