allow http header options