trying CORS tweeks