add CORS for get methods