fix cors headers for safari