removed header for CORS origin