fix .htaccess for CORS works