FEATURE: allow adding access control headers