add cors in selectively on GETs (bug 794496)