add cors headers requirements