cleanup and add CORS