add CORS header for GET requests