add xhr header when sending ajax