add CORS headers to nancy sample