adding cross domain header