allow cros headers through