added CORS, remove Server header