cors support, closes #25

self explanatory