added content-type header to CORS