reverted to combined ajax & app server for CORS issues