added access control headers to application controller