adding headers in an express middleware to allow distant access