access origin * and header to match request