fix CORS for heroku 7