Added access control to headers in controller js