add cors stuff to get ajax stuff working