added Access-Control-Allow-Origin

;
merge