make it do cors for POST too