differen cors config for dev/prd