use removed
configurable CORS added

eventually we should set this on a per RESTlet basis