add in CORS support to the GET to allow m-site to access