try to use CORS correctly