main: add CORS support