added cors headers to session controller