added access control allow origin to server.js