adding cors and tracking origin instead of referrer