add Accept,X-Requested-With for Access-Control-Allow-Headers response header