the HttpResponse should not have access to the request headers