headers['Access-Control-Allow-Origin'] = 'null'
just testing cross domain
client must put Origin header in request