allow cross-domain ajax over https

for more info see https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS#Access-Control-Allow-Origin

also, allowed setting custom name for the http header.