removed cross origin headers from dto.js