naive CORS support