adds basic CORS handling