add a simple CORS filter to allow cross-origin requests
move resource classes into their own package