ANTARCTICLE-168 explicit header filtering to prevent CSRF