- added allow origin headers to all responses