remove original site's CORS headers and use our own