fix access control header