support CORS
fix bugs