send back headers for CORS.

References #14