the x-requested-with, not sure, will check, the others are needed for cors to work