allow cors, add methods and content-type headers