adding correct headers in CORS reponses, plus passing test