added set_headers to application controller. trying to allow cross domain requests from ajax