How to restrict access based on request headers.
