fix allow-origin header getting over-written