extra headers for CORS