Bug refs #1870: add custom header handling and dynamically add allow-origin