fixing access control headers