fix cors headers