webapi: enhance header to block forbidden response headers