fix CORS issue by adding new headers