I think, for me at least, it depends on what the metadata relates to. If the metadata is related to the request, then it’s fine to put it in the headers. If the metadata is related to the resource in question (relationships for instance) then it should go in the body.

I knew that particular suggestion would be a bit controversial and I might write another article clarifying my thoughts with the caveats (APIs designed for more than just HTTP as a transport for instance)