refactor - move
add CORS headers to allow widget and its resources to be access across domains