allow CORS for origin and custom headers; accept and handle post data