expose 'GET' and allow any origin
add html