added measures to prevent CORS based security issues