add Cache-Control: no-cache and CORS header to make validator happy