fixes to CORS headers