adding rack cors, allow ajax CORS