sigh. updated cors header to include protocol