correct staging env cors origins for local client testing