add cors headers
minor refactor