add cors, add requirements to package.json