elaborate on header directive

src/docs/markdown/caddyfile/directives/encode.md

@@ -31,7 +31,7 @@ encode [<matcher>] <formats...> {
 
 	match {
 		status <code...>
-		header <field> [<value>]
+		header <field> <value>
 	}
 }
 ```

src/docs/markdown/caddyfile/directives/header.md

@@ -37,6 +37,15 @@ header [<matcher>] [[+|-|?|>]<field> [<value>|<find>] [<replace>]] {
 	?<field> <value>
 
 	[defer]
+
+	# a match condition
+	match [status <code...> | header <field> <value>]
+
+	# or a match block
+	match {
+		status <code...>
+		header <field> <value>
+	}
 }
 ```
 
@@ -44,13 +53,13 @@ header [<matcher>] [[+|-|?|>]<field> [<value>|<find>] [<replace>]] {
 
   With no prefix, the field is set (overwritten).
 
-  Prefix with `+` to add the field instead of overwriting (setting) the field if it already exists; header fields can appear more than once in a request.
+  Prefix with `+` to add the field instead of overwriting (setting) the field if it already exists; header fields can appear more than once in a response.
 
   Prefix with `-` to delete the field. The field may use prefix or suffix `*` wildcards to delete all matching fields.
 
   Prefix with `?` to set a default value for the field. The field is only written if it doesn't yet exist.
 
-  Prefix with `>` to set the field, and enable `defer`, as a shortcut.
+  Prefix with `>` to replace the contents of an existing header value using a regular expression. Implies `defer`, see below.
 
 - **&lt;value&gt;** is the header field value, when adding or setting a field.
 
@@ -58,7 +67,13 @@ header [<matcher>] [[+|-|?|>]<field> [<value>|<find>] [<replace>]] {
 
 - **&lt;replace&gt;** is the replacement value; required if performing a search-and-replace. Use `$1` or `$2` and so on to reference capture groups from the search pattern. If the replacement value is `""`, then the matching text is removed from the value. See the [Go documentation](https://golang.org/pkg/regexp/#Regexp.Expand) for details.
 
-- **defer** will force the header operations to be deferred until the response is being written out to the client. This is automatically enabled if any of the header fields are being deleted with `-`, when setting a default value with `?`, or when having used the `>` prefix.
+- **defer** defers the execution of header operations until the response is being sent to the client. This option is automatically enabled under the following conditions:
+	- When any header fields are deleted using `-`.
+	- When setting a default value with `?`.
+	- When using the `>` prefix to replace within the header value.
+	- When one or more `match` conditions are present.
+
+- **match** <span id="match"/> is an inline [response matcher](/docs/caddyfile/response-matchers). Header operations are applied only to responses that satisfy the specified conditions.
 
 For multiple header manipulations, you can open a block and specify one manipulation per line in the same way.
 
@@ -67,7 +82,7 @@ When using the `?` prefix to set a default header value, it is automatically sep
 
 ## Examples
 
-Set a custom header field on all requests:
+Set a custom header field on all responses:
 
 ```caddy-d
 header Custom-Header "My value"
@@ -119,6 +134,44 @@ header ?Cache-Control "max-age=3600"
 reverse_proxy upstream:443
 ```
 
+Mark all successful responses to GET requests as cacheable for upto an hour:
+
+```caddy-d
+@GET {
+	method GET
+}
+header @GET Cache-Control "max-age=3600" {
+	match status 2xx
+}
+reverse_proxy upstream:443
+```
+
+Prevent caching of error responses in the event of an exception in the upstream server:
+
+```caddy-d
+header {
+	-Cache-Control
+	-CDN-Cache-Control
+	match status 500
+}
+reverse_proxy upstream:443
+```
+
+Prevent overly-permissive CORS headers by replacing wildcard values with a specific domain:
+```caddy-d
+header >Access-Control-Allow-Origin "\*" "allowed-partner.com"
+reverse_proxy upstream:443
+```
+**Note**: In replacement operations (prefixed with `>`), the `<find>` value is interpreted as a regular expression. To match the `*` character, it must be escaped with a backslash as shown in the above example.
+
+Alternatively, you may use a [response matcher](/docs/caddyfile/response-matchers) to match a header value verbatim:
+```caddy-d
+header Access-Control-Allow-Origin "allowed-partner.com" {
+	match header Access-Control-Allow-Origin *
+}
+reverse_proxy upstream:443
+```
+
 To override the cache expiration that a proxy upstream had set for paths starting with `/no-cache`; enabling `defer` is necessary to ensure the header is set _after_ the proxy writes its headers:
 
 ```caddy-d