remove CORS headers -- without jsbin there is no need for them