fixed cors to send back plain text with REST options