add CORS headers application