fixed error with headers for CORS