server: adding cross origin support