fix CORS with github