allow X-Impersonate-User HTTP header in cross-domain XHRs