add origin headers for CORS support