add access control header to font requests