add CORS support so the server can be invoked from an arbitrary webpage