updated package.json for heroku
allow cors