fix for content-type header in cors