hostname restriction
clean up cors codes