add cors headers - fixes #570