attempt to fix CORS revised