fix CORS for heroku 6