CORS support

thanks to nginx config which is not in the repo