put CORS header in the right place