always send CORS header