set CORS headers on .well-known requests