send cors headers
switch headers to middlewear