respect session required http header