send the x-json header to stop browser complaints about unsafe header