diff --git a/components/net/fetch/methods.rs b/components/net/fetch/methods.rs
index 49a4180e03f..996a7baec28 100644
--- a/components/net/fetch/methods.rs
+++ b/components/net/fetch/methods.rs
@@ -5,13 +5,13 @@
 use connector::create_http_connector;
 use data_loader::decode;
 use fetch::cors_cache::CORSCache;
-use http_loader::{HttpState, set_request_cookies};
+use http_loader::{HttpState, set_default_accept_encoding, set_request_cookies};
 use http_loader::{NetworkHttpRequestFactory, ReadResult, obtain_response, read_block};
 use hyper::header::{Accept, AcceptLanguage, Authorization, AccessControlAllowCredentials};
 use hyper::header::{AccessControlAllowOrigin, AccessControlAllowHeaders, AccessControlAllowMethods};
 use hyper::header::{AccessControlRequestHeaders, AccessControlMaxAge, AccessControlRequestMethod, Basic};
 use hyper::header::{CacheControl, CacheDirective, ContentEncoding, ContentLength, ContentLanguage, ContentType};
-use hyper::header::{Encoding, HeaderView, Headers, IfMatch, IfRange, IfUnmodifiedSince, IfModifiedSince};
+use hyper::header::{Encoding, HeaderView, Headers, Host, IfMatch, IfRange, IfUnmodifiedSince, IfModifiedSince};
 use hyper::header::{IfNoneMatch, Pragma, Location, QualityItem, Referer as RefererHeader, UserAgent, q, qitem};
 use hyper::method::Method;
 use hyper::mime::{Mime, SubLevel, TopLevel};
@@ -766,15 +766,31 @@ fn http_network_or_cache_fetch(request: Rc<Request>,
         _ => {}
     }
 
+    let current_url = http_request.current_url();
     // Step 12
-    // modify_request_headers(http_request.headers.borrow());
+    // todo: pass referrer url and policy
+    // this can only be uncommented when the referer header is set, else it crashes
+    // in the meantime, we manually set the headers in the block below
+    // modify_request_headers(&mut http_request.headers.borrow_mut(), &current_url,
+    //                        None, None, None);
+    {
+        let headers = &mut *http_request.headers.borrow_mut();
+        let host = Host {
+            hostname: current_url.host_str().unwrap().to_owned(),
+            port: current_url.port_or_known_default()
+        };
+        headers.set(host);
+        // accept header should not be set here, unlike http
+        set_default_accept_encoding(headers);
+    }
 
     // Step 13
     // TODO some of this step can't be implemented yet
     if credentials_flag {
         // Substep 1
         // TODO http://mxr.mozilla.org/servo/source/components/net/http_loader.rs#504
-        set_request_cookies(&http_request.current_url(),
+        // XXXManishearth http_loader has block_cookies, should we do this too?
+        set_request_cookies(&current_url,
                             &mut *http_request.headers.borrow_mut(),
                             &state.cookie_jar);
         // Substep 2
@@ -787,7 +803,6 @@ fn http_network_or_cache_fetch(request: Rc<Request>,
 
             // Substep 5
             if authentication_fetch_flag {
-                let current_url = http_request.current_url();
 
                 authorization_value = if has_credentials(&current_url) {
                     Some(Basic {
diff --git a/components/net/http_loader.rs b/components/net/http_loader.rs
index e62fc2dd415..43ae8af7fa3 100644
--- a/components/net/http_loader.rs
+++ b/components/net/http_loader.rs
@@ -370,7 +370,7 @@ impl Error for LoadErrorType {
     }
 }
 
-fn set_default_accept_encoding(headers: &mut Headers) {
+pub fn set_default_accept_encoding(headers: &mut Headers) {
     if headers.has::<AcceptEncoding>() {
         return
     }
@@ -627,10 +627,7 @@ fn request_must_be_secured(url: &Url, hsts_list: &Arc<RwLock<HstsList>>) -> bool
 pub fn modify_request_headers(headers: &mut Headers,
                               url: &Url,
                               user_agent: &str,
-                              cookie_jar: &Arc<RwLock<CookieStorage>>,
-                              auth_cache: &Arc<RwLock<AuthCache>>,
-                              load_data: &LoadData,
-                              block_cookies: bool,
+                              referrer_policy: Option<ReferrerPolicy>,
                               referrer_url: &mut Option<Url>) {
     // Ensure that the host header is set from the original url
     let host = Host {
@@ -654,23 +651,13 @@ pub fn modify_request_headers(headers: &mut Headers,
     set_default_accept_encoding(headers);
 
     *referrer_url = determine_request_referrer(headers,
-                                               load_data.referrer_policy.clone(),
+                                               referrer_policy.clone(),
                                                referrer_url.clone(),
                                                url.clone());
 
     if let Some(referer_val) = referrer_url.clone() {
         headers.set(Referer(referer_val.into_string()));
     }
-
-    // https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch step 11
-    if load_data.credentials_flag {
-        if !block_cookies {
-            set_request_cookies(&url, headers, cookie_jar);
-        }
-
-        // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch step 12
-        set_auth_header(headers, url, auth_cache);
-    }
 }
 
 fn set_auth_header(headers: &mut Headers,
@@ -956,10 +943,18 @@ pub fn load<A, B>(load_data: &LoadData,
         let request_id = uuid::Uuid::new_v4().simple().to_string();
 
         modify_request_headers(&mut request_headers, &doc_url,
-                               &user_agent, &http_state.cookie_jar,
-                               &http_state.auth_cache, &load_data,
-                               block_cookies, &mut referrer_url);
+                               &user_agent, load_data.referrer_policy,
+                               &mut referrer_url);
 
+        // https://fetch.spec.whatwg.org/#concept-http-network-or-cache-fetch step 11
+        if load_data.credentials_flag {
+            if !block_cookies {
+                set_request_cookies(&doc_url, &mut request_headers, &http_state.cookie_jar);
+            }
+
+            // https://fetch.spec.whatwg.org/#http-network-or-cache-fetch step 12
+            set_auth_header(&mut request_headers, &doc_url, &http_state.auth_cache);
+        }
         //if there is a new auth header then set the request headers with it
         if let Some(ref auth_header) = new_auth_header {
             request_headers.set(auth_header.clone());