more fixes to fix access-control headers