fix api url
allow cross-origin
fix origin cross