add support for CORS (for * hosts at the moment)