add CORS header to .htaccess to allow cross-origin requests