add delegating handler to process CORS requests