I don't think request stores headers. I tried but couldn't find it in the sources or through introspection. The response object has it, and I included that here. Had to do some work arounds as just returning response.headers generated a ticket, but these are the headers for when Auth is activated:
JSON: {u'Expires': u'Wed, 14 Sep 2011 20:18:14 GMT', u'Content-Type': u'application/json; charset=utf-8', u'X-Powered-By': u'web2py', u'Pragma': u'no-cache', u'Cache-Control': u'no-store, no-cache, must-revalidate, post-check=0, pre-check=0'} XML: {'Expires': 'Wed, 14 Sep 2011 20:18:15 GMT', 'Content-Type': 'text/xml', 'Cache-Control': 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Pragma': 'no-cache', 'X-Powered-By': 'web2py'} And when Auth is deactivated: JSON: {u'Expires': u'Wed, 14 Sep 2011 20:19:59 GMT', u'Content-Type': u'application/json; charset=utf-8', u'X-Powered-By': u'web2py', u'Pragma': u'no-cache', u'Cache-Control': u'no-store, no-cache, must-revalidate, post-check=0, pre-check=0'} XML: {'Expires': 'Wed, 14 Sep 2011 20:20:00 GMT', 'Content-Type': 'text/xml', 'Cache-Control': 'no-store, no-cache, must-revalidate, post-check=0, pre-check=0', 'Pragma': 'no-cache', 'X-Powered-By': 'web2py'}