#74 allowing more cors headers