response['Access-Control-Allow-Origin'] = '*'