foo.diff

diff --git a/app_website/server/routes/lib/endpoint.js b/app_website/server/routes/lib/endpoint.js
index 939bd418a..3ff80b6d8 100644
--- a/app_website/server/routes/lib/endpoint.js
+++ b/app_website/server/routes/lib/endpoint.js
@@ -14,10 +14,11 @@ import util from '../../util';
 import type { Device } from '../../util';
 
 type Query = { [string]: string | void };
+type Headers = { [string]: string | void };
 type SafeRequest<Body, Params> = {|
   userId: number,
   path: string,
-  // headers: {| +[string]: mixed |},
+  headers: Headers,
   body: Body,
   device: Device,
   params: Params,
@@ -53,6 +54,9 @@ function fail(errmsg: string): void {
 // will be decoded as { foo: 'bar', qux: '123' }
 const queryDecoder: Decoder<Query> = dict(optional(string));
 
+// All headers will be decoded as strings as well
+const headerDecoder: Decoder<Headers> = dict(optional(string));
+
 /**
  * The endpoint() wrapper makes Express route definitions type-safe.  Here's
  * how you configure it:
@@ -103,6 +107,7 @@ export default function endpoint<Body, Params>(
       // Try a best-effort attempt to decode the request's query
       const path: string = string(req.path).withDefault('');
       const query: Query = queryDecoder(req.query).withDefault({});
+      const headers: Headers = headerDecoder(req.headers).withDefault({});
 
       // headers: {| +[string]: mixed |},
       const device: Device = req.device;
@@ -122,6 +127,7 @@ export default function endpoint<Body, Params>(
               const safeReq: SafeRequest<Body, Params> = {
                 userId,
                 path,
+                headers,
                 body,
                 device,
                 params,