add a read-only url to x-origin response objects.