support cors, move client to separate module