add missing cross site header