fix CORS for heroku 12