bump version to 2.4.2.0
defensive checks on package scanning, and extra logging
support CORS headers