add access control header for same-origin policy