configured CORS for local testing