If post request, always add allowed origin header

Reviewers: marcua, lydia

Reviewed By: lydia

Differential Revision: http://phabricator.locu.com/D3814