set cors headers in contributors-controller