advanced settings tab; ability to set allow-from uri header