DocCode: enable CORS