properly set up cors headers to allow cross-origin resource sharing