add legal headers to xhr request from options [ 0.0.8 ]