added CORS functionality