added CORS to 2.0.2