add access control header