added very basic CORS config