AJAX: header_add: fix missing nonce issue