important bug in prefix generaion algo
Only set the withCredentials flag on https: requests, as otherwise it blocks getting public http: data files by CORS
remove the callback on every headers event