use wai-cors for cross-origin
prep for live