fix CORS with posting inventories