removed custom header, added allow origin setting