added CORS directives