forwards headers; authorized roles in template