allow header X-Koc-Session