fix CORS for heroku 3