requests return CORS headers