simple CORS
post data parsing