fix issue #6 - add CORS header