added header X-Expand-Links to CORS