add .htaccess for cors