simple server with CORS