added header() to allow cross site access