added CORS headers for all objects