fix for cors and header