enhanced CORS support