request_headers

Should exclude manual blacklist ("Auth" by default)