added cors and no-cache headers