changes with CORS for JS and HTML