+ http: add model for CORS headers