- they have the allow origin header working again