add simple middleware before ActionDispatch::Static
that adds CORS header for GET requests