changed access headers for production
changing control headers again
css now in build from Angular, access control changed to allow only localhost:8080