added sample cors and server side encryption policy