res.redirect via 303, minimal headers