added CORS support, hopefully