allow all headers so JSON get request works