added CORS allowance headers
added CORS allowance headers