update cors settings for heroku