allow CORS on feed endpoints