add allow headers to fix xhr
fix body parsing