use apache headers to set CORS policy