added CORS support built-in
added boilerplate for cors config, defaults to disabled.