No idea what the issue is there. Since the header you added is the same as the header below it. And it matches what it’s the docs for XMLHttpRequest.
Remove the image as it leaks an oAuth which is a secret and secrets should not be publically reveeled.