added cors headers to allow serving fonts