added CORS middleware
updated the header to be the right server
allow anyone to connect