need to specify in web.xml the header to be exposed cross origin