fix allow headers