add cross_origin_header