APM: Inserting headers for back-end servers to process.

Thanks guys the actual issue was on the server-side. I was able to insert them in ACCESS_ACL_ALLOWED event as suggested initial above. But when I did it there where issues on the application side and it is now fixed. However the above irule that you provided dubdub made me think I might want to check for existing sessions and re-insert the headers for these, however the application generates a JSESSIONID to track the session after authentication so I may not ever need to. Thank you guys for your help.