enable cors attributes and add headers for access control allow