playing with cors - not really working