CORS headers not needed anymore. see previous comment