Fix cors, update passenger