adds On-Behalf-Of header functionality to box requests