enable socket filtering in HEAD, too