fixed cross domain access
fixed header types allowed
added X-Requested-With