note to self.. make sure this header is accounted for in the CORS filter config