added cors stuff to application.rb