I've just pushed a changeset which adds a simple interface for getting
request headers and setting response headers. See the section of
basis.urs beginning at the line "type requestHeader". Header names may
be whitelisted in .urp files in the same way as URLs, with directives like:
allow requestHeader User-Agent
allow responseHeader Prefix/*