remember to expose headers on cors configuration