fix CORS
modify config to match heroku