added simple CORS implementation