added CORS behaviour to products.jsp