headers black list for filtering out auth-token