more CORS headers for debugging