avoid non-ascii
fix CORS header