Add access control headers to api controller