Nginx Lua module for redirecting based on proxy and access headers

Question

In nginx I want to redirect user based on access and proxy headers. When I put it to the response header, they are shown correctly in the browser. But when using in lua to redirect with an if it does not.

For user with access app creates string isprotectedfalse and for guests I get isprotected

        add_header X-User-Access-Flag  $userinfo$arg_limit$upstream_http_x_doc_protection; #this works
        if ($http_x_user_access_flag = "isprotected") { #this doesnt
          return 302 $scheme://$http_host$uri?limit=true;
        }

and similar code but in lua:

             rewrite_by_lua_block {
                local params = ngx.req.get_uri_args()
                local limit = params["limit"]
                local headers = ngx.resp.get_headers()
                local useraccesss = headers["X-User-Access-Flag"]
                if useraccesss == "isprotected" and limit == nil then
                    local delimiter = (ngx.var.is_args == "" or ngx.var.is_args == nil) and "?" or "&"
                    local new_url = ngx.var.request_uri .. delimiter .. "limit=true" 
                    return ngx.redirect(new_url)
                end
             }

why is it not redirecting as expected?

Edit: From using header_filter_by_lua_block

I have manage to access them from ngx.var['upstream_http_x_user_access_flag'] which is used before the lua block to set X-User-Access-Flag (from proxy_pass). But sadly server errors on redirection try. Seems at this point headers are already sent (but I am still able to set a custom header there?! so this is confusing.

I can not access such ngx.var from rewrite_by_lua_block as this has not performed proxy_pass yet. How could I access this variables after auth and proxy_pass and redirect based on aquired headers?