hardcode header to allow xhttprequest from other domains (allow origin = https://www.mailee.me)