Custom header from remote site

I had the cause wrong, it was due to not including credentials in a CORS request, solved by using ajax and including the credentials