www-cgi: whitelist some more HTTP headers