always send CORS headers