node-light: fix CORS