allow cors, add more  headers