set allowed headers