XhrSharing middleware additional headers