removed x api key from cross domain control headers