removed CORS header