add whitelist for header