add cors support, send status with controller responses, no redirects