small change to controller. Haven't figured out CORS