added access control headers