updated the cors options header to allow every request domain set through