add access-control headers on all requests, not just options.