fix issue 6 - add CORS header