allow headers in user content