set CORS headers
tests in browser