hack using iframe and window.postMessage to allow custom headers on IE8/9