accepted headers as array, add x-cily-* headers
user token auth middleware