Append access control allow to response header