added cors filter for cross site REST client access