cut to express because hapi's CORS implementation is busted