adding cors headers - working version