allow cross domain for content type, access and x-api-key