making CORS more flexible, allowing all request headers