add CORS and connection close headers to streams/files, was just on xsl