add CORS for proxy