cors

added basic CORS support