always set common HTTP headers; closes #989