get rid origin *, it should take care apache set header