add cross site scripting allow headers

add cross site scripting allow headers. working solution from irc.