fixed cors so now works with the companion web app :)