Adding response header to allow all XHR origins