fix CORS by changing https to http