added header control to backend for cross domain comms