adding access control header for ajax calls