allow x-requested-with header