fix CORS headers