add allow-access-origin to response
fixing make_response
change form vars