use validating http headers

good point. I guess I can't trust @mies =p