set CORS policy for bootstrap files