fix for CORS; in the BasicController stuffed the 3 headers