access control headers in dev and pro