update header for CORS