removed CORS headers
added CORS headers