add rudimentary CORS * support