move Access-Control- header to config, fix getConfig method