add access control header to get