allowing CORS for example in apache .htaccess