serve static assets and use CORS
use writable streams for image processing