allow CORS for segments call