add access control header + add static resource routes