added CORS to server