use validating http headers

See: https://github.com/wercker/registry/blob/9616486680c3ae469d14076ff8bcbe4d7229dd02/util.go#L17-L25