fix(api): add dynamic origin header