added XSS allow header