added cors support to castra