no need to validate http headers