writing "bcc: someone@email.com" sometimes triggers WAF rules