comment out "Access-Control-Allow-Headers" field for httpresponse