Fixing CORS headers

in order to get CORS working correctly, the headers must be set in every response (not just OPTIONS)