updated cors for app.local