query string vs request header