add AJAX header (for Same Origin error)