add simple CORS support