update for cors and web api2

needs safari support