allowed CORS
fixed typo