added extra header for prototype's ajax security.