add requesttoken to save xhr in Server.js, fetch correct headers in controller