enable cross-origin resource sharing (CORS)