adding header setting permissions