add CORS constants