core: enable CORS (Access-Control-Allow-Origin: *)