add http header to native ajax exploit