added more CORS logic to support mobile app