fix cors based on manual testing