delegated requests use X-User and X-From headers