add cors headers even for error pages