fixed security issue
added bundle for cors headers