first pass
removing still here
adding CORS support
adding specific origin