fix "Access-Control-Allow-Headers" not allowing "X-Requested-With" and "Content-Type"