controller can set status & headers of response

done