give a CORS response