modified CORS headers