[wip] Trace requests

Still wonder if there are any security implications on allowing this header to always be set (also outside dev/test).