Fix typo with allow host for cors