added CORS enabled support for cards