more headers to make CORS work