cors for server sent events.