Set header in after filter.
Finally, fix access control issue.