Some request headers are more trustworthy than others