added CORS capabilities