fix(CORS): now handled in APP