added header for XSS post.