fixing set cors headers