added CORS support, will revisit later