unify error messages.  Add CORS headers on errors