diff --git a/data/rules.json b/data/rules.json
index bddafdc..a174d28 100644
--- a/data/rules.json
+++ b/data/rules.json
@@ -1,6 +1,18 @@
 [
   {
     "disabled": false,
+    "target": ".*",
+    "operator": "addRespHeader",
+    "destination": "Access-Control-Allow-Origin=*|X-WEBKIT-CSP=*"
+  },
+  {
+    "disabled": false,
+    "target": ".*",
+    "operator": "addRespHeader",
+    "destination": "x-google-cache-control=max-age=0, no-cache, no-store, must-revalidate|Cache-Control=max-age=0, no-cache, no-store, must-revalidate"
+  },
+  {
+    "disabled": false,
     "target": ".*play.google.com.*",
     "operator": "block",
     "destination": ""
diff --git a/package.json b/package.json
index 54d7d58..7d5feca 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+  "version": "0.0.9",
   "name": "gerrit-fe-dev-helper",
   "license": "MIT",
   "dependencies": {
@@ -13,7 +14,6 @@
     "webpack": "^4.41.2",
     "webpack-cli": "^3.3.10"
   },
-  "version": "0.0.1",
   "description": "Dev helper for gerrit fe development",
   "scripts": {
     "assets:html": "cp src/*.html dist",
diff --git a/release-notes.md b/release-notes.md
index 4a17cf3..3b4a9c8 100644
--- a/release-notes.md
+++ b/release-notes.md
@@ -1,3 +1,9 @@
+#### v0.0.9
+
+- Move cors / cache override to rules, so user can disable it from the popup
+- Change header value separator from `,` to `|`, as `,` can be part of the value while `|` is unlikely
+- Fix `onGerritReady` to use tag name instead of id and max at 5s ;)
+
 #### v0.0.8
 
 - **BREAKING CHNAGE**: Gerrit is moving to `gr-app.js` only, so `gr-app.html` will no longer exists, we have updated default rules to forward to `gr-app.js` as well, in case you are still using `gr-app.html`, please modify that redirect rule by changing `gr-app.js` to `gr-app.html`
diff --git a/src/background.ts b/src/background.ts
index 420f99f..215fe48 100644
--- a/src/background.ts
+++ b/src/background.ts
@@ -53,32 +53,6 @@
     return {responseHeaders: resp.responseHeaders};
   }
 
-  let len = resp.responseHeaders.length;
-  if (len > 0) {
-    while (--len) {
-      const header = resp.responseHeaders[len];
-      if (header.name.toUpperCase() === 'X-WEBKIT-CSP') {
-        header.value = '*';
-        break;
-      } else if (header.name.toLowerCase() === 'access-control-allow-origin') {
-        resp.responseHeaders[len].value = '*';
-        break;
-      } else if (
-          header.name.toLowerCase() === 'cache-control' ||
-          header.name.toLowerCase() === 'x-google-cache-control') {
-        header.value = 'max-age=0, no-cache, no-store, must-revalidate';
-      }
-    }
-  }
-
-  // add cors and cache anyway
-  resp.responseHeaders.push(
-      {'name': 'Access-Control-Allow-Origin', 'value': '*'});
-  resp.responseHeaders.push({
-    'name': 'Cache-Control',
-    'value': 'max-age=0, no-cache, no-store, must-revalidate'
-  });
-
   const matches = rules.filter(isValidRule)
                     .filter(
                         rule => rule.operator === Operator.REMOVE_RESPONSE_HEADER
@@ -95,7 +69,7 @@
                           && !rule.disabled
                           && new RegExp(rule.target).test(resp.url));
   addMatches.forEach(rule => {
-    const addedHeaders = rule.destination.split(",")
+    const addedHeaders = rule.destination.split("|")
     addedHeaders.forEach(addedHeader => {
       const partial = addedHeader.split("=");
       if (partial.length === 2) {
diff --git a/src/content_script.ts b/src/content_script.ts
index 7e3071a..19245a7 100644
--- a/src/content_script.ts
+++ b/src/content_script.ts
@@ -14,16 +14,28 @@
 
 // Since content-script can not access window.Gerrit,
 // here checks the readiness based on #mainHeader element
+// Wait at most 5s before considering it as loaded.
+const MAX_WAIT_TIME = 5000;
+const getHeaderEl = () => {
+  if (document.querySelector("#app")) {
+    return document.querySelector("#app").shadowRoot.querySelector("#app-element").shadowRoot.querySelector("#mainHeader");
+  } else {
+    return document.querySelector("gr-app").shadowRoot.querySelector("gr-app-element").shadowRoot.querySelector("gr-main-header");
+  }
+}
 const onGerritReady = async () => {
   let header;
   try {
-    header = document.querySelector("#app").shadowRoot.querySelector("#app-element").shadowRoot.querySelector("#mainHeader");
+    header = getHeaderEl();
   } catch (e) { }
 
+  let waitTime = 0;
   while (!header) {
+    if (waitTime > MAX_WAIT_TIME) break;
+    waitTime += 1000;
     await nextTick(1000);
     try {
-      header = document.querySelector("#app").shadowRoot.querySelector("#app-element").shadowRoot.querySelector("#mainHeader");
+      header = getHeaderEl();
     } catch (e) { }
   }
   return true;
diff --git a/src/manifest.json b/src/manifest.json
index ab7599d..0ce92a0 100644
--- a/src/manifest.json
+++ b/src/manifest.json
@@ -2,7 +2,7 @@
   "manifest_version": 2,
   "name": "Gerrit FE Dev Helper",
   "description": "This extension can help you development on gerrit sites, frontend specifically",
-  "version": "0.0.8",
+  "version": "0.0.9",
   "browser_action": {
     "default_icon": "gray-32.png",
     "default_title": "Gerrit FE Dev Helper"
@@ -26,14 +26,11 @@
   ],
   "content_security_policy": "default-src 'none'; script-src 'self'; style-src 'unsafe-inline'; connect-src https://*",
   "permissions": [
-    "debugger",
     "activeTab",
     "<all_urls>",
-    "notifications",
     "storage",
     "tabs",
     "webRequest",
-    "webRequestBlocking",
-    "declarativeContent"
+    "webRequestBlocking"
   ]
 }
\ No newline at end of file