add cors headers to CAS filter, add apache CORS filter to web.xml