add header to allow access from other domains