better crossdomain support for headers