updated to properly handle cors