adding access-control-allow-origin in TK request ajaw