adding missing CORS stuff