fixed some things and requiring CORs to work