access header for private-token using crossdomain decorator