nlf: headers are on the request object right?