added CORS to loader's image object