comply with CORS: add Access-Control-Allow-Origin: * in header