enabling CORS for GET requests