remove CORS from ajax function