- do not naivly trust headers about content length