add CORS support (OPTIONS response for publisher and subscriber)