fix HTTP/2 header preload crossorigin problem by adding crossorigin=anonymous