removed CORS restrictions in application controller