add font CORS rule