fix cors headers for version