update url to avoid CORS