add support for CORS, tested with success from console only