add github.com to CORS