access control headers update