proctor needs to return correct cors headers on post