fix CORS as announced per email