try x-requested-with for CORS