add CORS headers on archive endpoint