upon closer review of CORS spec, most headers are only valid for the preflight response
bump to v0.0.5