use request header instead of the query string