support browser requests via CORS