added CORS header to allow cross-origin resource sharing