added CORS support
fixed 400 error message bug