add CORS headers to support client apps