HTTP headers for CORS/cross-origin-long-polling