added CORS headers to the application controller