added cors stuff to ajax session