allow default response header