add Access-Control-Allow-Origin header, remove (?) in production
new args
process new parameters