change http header fields for CORS