add CORS headers on frontdoor