--- a/doc/manual.tex	Sun May 29 13:31:53 2011 -0400
+++ b/doc/manual.tex	Sun May 29 14:29:26 2011 -0400
@@ -136,7 +136,7 @@
 
 Here is the complete list of directive forms.  ``FFI'' stands for ``foreign function interface,'' Ur's facility for interaction between Ur programs and C and JavaScript libraries.
 \begin{itemize}
-\item \texttt{[allow|deny] [url|mime] PATTERN} registers a rule governing which URLs or MIME types are allowed in this application.  The first such rule to match a URL or MIME type determines the verdict.  If \texttt{PATTERN} ends in \texttt{*}, it is interpreted as a prefix rule.  Otherwise, a string must match it exactly.
+\item \texttt{[allow|deny] [url|mime|requestHeader|responseHeader] PATTERN} registers a rule governing which URLs, MIME types, HTTP request headers, or HTTP response headers are allowed to appear explicitly in this application.  The first such rule to match a name determines the verdict.  If \texttt{PATTERN} ends in \texttt{*}, it is interpreted as a prefix rule.  Otherwise, a string must match it exactly.
 \item \texttt{alwaysInline PATH} requests that every call to the referenced function be inlined.  Section \ref{structure} explains how functions are assigned path strings.
 \item \texttt{benignEffectful Module.ident} registers an FFI function or transaction as having side effects.  The optimizer avoids removing, moving, or duplicating calls to such functions.  Every effectful FFI function must be registered, or the optimizer may make invalid transformations.  This version of the \texttt{effectful} directive registers that this function only has side effects that remain local to a single page generation.
 \item \texttt{clientOnly Module.ident} registers an FFI function or transaction that may only be run in client browsers.
@@ -1406,6 +1406,20 @@
   \mt{val} \; \mt{fileData} : \mt{file} \to \mt{blob}
 \end{array}$$
 
+It is also possible to get HTTP request headers and set HTTP response headers, using abstract types similar to the one for URLs.
+
+$$\begin{array}{l}
+  \mt{type} \; \mt{requestHeader} \\
+  \mt{val} \; \mt{blessRequestHeader} : \mt{string} \to \mt{requestHeader} \\
+  \mt{val} \; \mt{checkRequestHeader} : \mt{string} \to \mt{option} \; \mt{requestHeader} \\
+  \mt{val} \; \mt{getHeader} : \mt{requestHeader} \to \mt{transaction} \; (\mt{option} \; \mt{string}) \\
+  \\
+  \mt{type} \; \mt{responseHeader} \\
+  \mt{val} \; \mt{blessResponseHeader} : \mt{string} \to \mt{responseHeader} \\
+  \mt{val} \; \mt{checkResponseHeader} : \mt{string} \to \mt{option} \; \mt{responseHeader} \\
+  \mt{val} \; \mt{setHeader} : \mt{responseHeader} \to \mt{string} \to \mt{transaction} \; \mt{unit}
+\end{array}$$
+
 A blob can be extracted from a file and returned as the page result.  There are bless and check functions for MIME types analogous to those for URLs.
 $$\begin{array}{l}
   \mt{type} \; \mt{mimeType} \\