Add allow header to redirects
Fix xss problem