CORS not working, need the server side improvement