put CORS header in the right place
Merge pull request #234 from bepetersn/v2.0-dev

put CORS header in the right place