when in cross-origin mode, set Access-Control-Allow-Headers
added Access-Control-Allow-Methods