support CORS, EverythingMe/ffos-notes#25