added cors headers to app