diff --git a/lib/client.c b/lib/client.c
index ef17ca8..9074ff8 100644
--- a/lib/client.c
+++ b/lib/client.c
@@ -594,10 +594,25 @@
 					  !libwebsocket_ensure_user_space(wsi))
 		goto bail2;
 
+	/*
+	 * we seem to be good to go, give client last chance to check
+	 * headers and OK it
+	 */
+
+	wsi->protocol->callback(context, wsi,
+				LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH,
+						     wsi->user_space, NULL, 0);
+
 	/* clear his proxy connection timeout */
 
 	libwebsocket_set_timeout(wsi, NO_PENDING_TIMEOUT, 0);
 
+	/* free up his parsing allocations */
+
+	for (n = 0; n < WSI_TOKEN_COUNT; n++)
+		if (wsi->utf8_token[n].token)
+			free(wsi->utf8_token[n].token);
+
 	/* mark him as being alive */
 
 	wsi->state = WSI_STATE_ESTABLISHED;
@@ -645,6 +660,12 @@
 			 wsi->user_space,
 			 NULL, 0);
 	lwsl_info("closing connection due to bail2 connection error\n");
+	/* free up his parsing allocations */
+
+	for (n = 0; n < WSI_TOKEN_COUNT; n++)
+		if (wsi->utf8_token[n].token)
+			free(wsi->utf8_token[n].token);
+
 	libwebsocket_close_and_free_session(context, wsi,
 						 LWS_CLOSE_STATUS_PROTOCOL_ERR);
 
diff --git a/lib/handshake.c b/lib/handshake.c
index 763aa4d..5c397ca 100644
--- a/lib/handshake.c
+++ b/lib/handshake.c
@@ -131,7 +131,6 @@
 		if (!wsi->protocol)
 			lwsl_err("NULL protocol at libwebsocket_read\n");
 
-
 		/*
 		 * It's websocket
 		 *
@@ -168,15 +167,6 @@
 		}
 
 		/*
-		 * find out which spec version the client is using
-		 * if this header is not given, we default to 00 (aka 76)
-		 */
-
-		if (wsi->utf8_token[WSI_TOKEN_VERSION].token_len)
-			wsi->ietf_spec_revision =
-				 atoi(wsi->utf8_token[WSI_TOKEN_VERSION].token);
-
-		/*
 		 * Give the user code a chance to study the request and
 		 * have the opportunity to deny it
 		 */
@@ -209,6 +199,14 @@
 			goto bail;
 		}
 
+		/* drop the header info */
+
+		/* free up his parsing allocations... these are gone... */
+
+		for (n = 0; n < WSI_TOKEN_COUNT; n++)
+			if (wsi->utf8_token[n].token)
+				free(wsi->utf8_token[n].token);
+
 		wsi->mode = LWS_CONNMODE_WS_SERVING;
 
 		/* union transition */
@@ -253,6 +251,7 @@
 
 bail:
 	lwsl_info("closing connection at libwebsocket_read bail:\n");
+
 	libwebsocket_close_and_free_session(context, wsi,
 						     LWS_CLOSE_STATUS_NOSTATUS);
 
diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index d747166..5c30c92 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -348,11 +348,6 @@
 	}
 #endif
 
-	/* free up his parsing allocations */
-
-	for (n = 0; n < WSI_TOKEN_COUNT; n++)
-		if (wsi->utf8_token[n].token)
-			free(wsi->utf8_token[n].token);
 #ifndef LWS_NO_CLIENT
 	if (wsi->c_address)
 		free(wsi->c_address);
diff --git a/lib/libwebsockets.h b/lib/libwebsockets.h
index f39f336..046ad0e 100644
--- a/lib/libwebsockets.h
+++ b/lib/libwebsockets.h
@@ -124,6 +124,7 @@
 enum libwebsocket_callback_reasons {
 	LWS_CALLBACK_ESTABLISHED,
 	LWS_CALLBACK_CLIENT_CONNECTION_ERROR,
+	LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH,
 	LWS_CALLBACK_CLIENT_ESTABLISHED,
 	LWS_CALLBACK_CLOSED,
 	LWS_CALLBACK_RECEIVE,
@@ -377,12 +378,20 @@
  *	You get an opportunity to initialize user data when called back with
  *	LWS_CALLBACK_ESTABLISHED reason.
  *
- *	LWS_CALLBACK_ESTABLISHED:  after the server completes a handshake with
+ *  LWS_CALLBACK_ESTABLISHED:  after the server completes a handshake with
  *				an incoming client
  *
  *  LWS_CALLBACK_CLIENT_CONNECTION_ERROR: the request client connection has
  *        been unable to complete a handshake with the remote server
  *
+ *  LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH: this is the last chance for the
+ *  				client user code to examine the http headers
+ *  				and decide to reject the connection.  If the
+ *  				content in the headers is interesting to the
+ *  				client (url, etc) it needs to copy it out at
+ *  				this point since it will be destroyed before
+ *  				the CLIENT_ESTABLISHED call
+ *
  *  LWS_CALLBACK_CLIENT_ESTABLISHED: after your client connection completed
  *				a handshake with the remote server
  *
diff --git a/lib/parsers.c b/lib/parsers.c
index 5ee5f46..6afc510 100644
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -470,8 +470,14 @@
 			}
 		}
 
-		if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE)
+		if (wsi->u.hdr.parser_state == WSI_TOKEN_CHALLENGE) {
+			if (wsi->utf8_token[WSI_TOKEN_CHALLENGE].token) {
+				free(wsi->utf8_token[WSI_TOKEN_CHALLENGE].token);
+				wsi->utf8_token[WSI_TOKEN_CHALLENGE].token = NULL;
+			}
+			wsi->utf8_token[WSI_TOKEN_CHALLENGE].token_len = 0;
 			goto set_parsing_complete;
+		}
 
 		break;
 
@@ -504,14 +510,16 @@
 
 set_parsing_complete:
 
-	if (!wsi->utf8_token[WSI_TOKEN_VERSION].token_len) {
-		lwsl_info("Missing Version Header\n");
-		return 1;
-	}
-	wsi->ietf_spec_revision =
-		 atoi(wsi->utf8_token[WSI_TOKEN_VERSION].token);
+	if (wsi->utf8_token[WSI_TOKEN_UPGRADE].token_len) {
+		if (!wsi->utf8_token[WSI_TOKEN_VERSION].token_len) {
+//			lwsl_info("Missing Version Header\n");
+//			return 1;
+		} else
+			wsi->ietf_spec_revision =
+				atoi(wsi->utf8_token[WSI_TOKEN_VERSION].token);
 
-	lwsl_parser("v%02d headers completed\n", wsi->ietf_spec_revision);
+		lwsl_parser("v%02d headers completed\n", wsi->ietf_spec_revision);
+	}
 	wsi->u.hdr.parser_state = WSI_PARSING_COMPLETE;
 
 	return 0;
diff --git a/lib/server-handshake.c b/lib/server-handshake.c
index 6fd9448..1afe22b 100644
--- a/lib/server-handshake.c
+++ b/lib/server-handshake.c
@@ -270,6 +270,12 @@
 
 
 bail:
+	/* free up his parsing allocations */
+
+	for (n = 0; n < WSI_TOKEN_COUNT; n++)
+		if (wsi->utf8_token[n].token)
+			free(wsi->utf8_token[n].token);
+
 	return -1;
 }
 
diff --git a/lib/server.c b/lib/server.c
index e3914a0..5a58672 100644
--- a/lib/server.c
+++ b/lib/server.c
@@ -118,13 +118,6 @@
 	 */
 	new_wsi->protocol = context->protocols;
 	new_wsi->user_space = NULL;
-
-	/*
-	 * Default protocol is 76 / 00
-	 * After 76, there's a header specified to inform which
-	 * draft the client wants, when that's seen we modify
-	 * the individual connection's spec revision accordingly
-	 */
 	new_wsi->ietf_spec_revision = 0;
 
 	return new_wsi;
diff --git a/libwebsockets-api-doc.html b/libwebsockets-api-doc.html
index 38f9e63..fb14ef0 100644
--- a/libwebsockets-api-doc.html
+++ b/libwebsockets-api-doc.html
@@ -604,6 +604,16 @@
 the request client connection has
 been unable to complete a handshake with the remote server
 </blockquote>
+<h3>LWS_CALLBACK_CLIENT_FILTER_PRE_ESTABLISH</h3>
+<blockquote>
+this is the last chance for the
+client user code to examine the http headers
+and decide to reject the connection.  If the
+content in the headers is interesting to the
+client (url, etc) it needs to copy it out at
+this point since it will be destroyed before
+the CLIENT_ESTABLISHED call
+</blockquote>
 <h3>LWS_CALLBACK_CLIENT_ESTABLISHED</h3>
 <blockquote>
 after your client connection completed