should work without CORS now