add CORS header to local rules