apparently cors isn't needed. oh well, it's there now anyway.