added: CORS header for content