whoops fix unit test
allow more access-control-headers for CORS support from jquery; closes #110