[api] added cross site header