added method to set cors headers in controller