added some response headers for CORS