added an option for CORS requests and surpress "refuse to get unsafe header X-JSON"