fixes for CORS