add in missing cross-domain headers