init support HTTP access control (CORS)