open up CORS headers so the ajax works with multiple servers