Add option to enforce request headers match that's off by default

[soffes]

Right now, we don't check them at all. It would be cool if you could opt-in to that.