setting header to allow web app to access API