adding CORS support, wide open for now