added access control header for full CORS access