moved Access-Control-Allow-Origin header into the conf file
made cors header optional