adds CORS support to allow cross-domain requests