add cors instructions