switched check to xhr header verification