add curator to the CORS headers