set CORS on the correct resource