added two more access control headers