x-truder.net/nginx: hack, add userid to cors allow headers