set manually access control headers in response object. Lets see if it works