only pull the netty bits we need
allow disabling header validation