add cors support, let everybody request our page