let's start from scratch
new, better, improved
restrict cors by origin